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Abstract—Pressure is an important parameter which 
affects the performance of the cryogenic engine. This 
paper presents the hardware implementation of Cryo- 
Pneumatic Engine Control Unit (ECU). When the liquid 
hydrogen (LH2) or liquid oxygen (LOX) tank pressure 
exceeds a specified limit, catastrophic failure may occur 
and when below a specified limit, the normal working of 
the launch vehicle is interrupted. The pressures of the 
tanks are maintained within safety limits through the 
implementation of cryo-pnuemo hydraulic algorithms, 
namely venting algorithm and isolation algorithm. This 
paper presents the idea of reducing the computational 
complexity of the processor for implementation of the 
algorithms, by offloading the processor and putting the 
logic in an FPGA. This result in reduction of memory 
usage, processor complexity, clock rate, and 
communication channel congestion. This also provides 
more computational margin. The paper describes the 
implementation of ECU onto a Xilinx based Virtex 5 
FPGA platform. 


Keywords—cryogenic, embedded system, engine control 
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I. INTRODUCTION 


MBEDDED system is becoming wide spread in _ all 
industries. Embedded system co-design is a major 
challenge faced by the design engineers. Co-design is the 
careful planning of dividing the tasks between hardware and 
software such that all the available resources are effectively 
utilized[1]. The launch vehicle is controlled in hard real time 
where a hard real time task should always meet the 
performance deadlines. The choice of hardware [2] is 
important in this aspect and hence implementation in hardware 
is an effective solution to meet deadlines. To get the advantage 
of both hardware and software, partitioning the task between 
hardware and software is done. Cryogenic stage operations 
include providing proper pressurization to and _ isolation 
between command gas bottle (CGB) and pressurization gas 
bottle (PGB). 
This paper tries to implement the venting algorithm and 
isolation algorithm on hardware. The proposed method 
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improves the execution time of the processor thereby giving 
more room for other critical real time tasks. 

The section II of the paper gives an overview about the 
structure of the cryogenic engine and the background of the 
project. Section III disucess the design of the ECU. It explains 
the hardware followed by the module wise block diagram of 
the ECU. The state machines implemented used are also 
discussed subsequently. Section IV disusses the results 
obtained from the implementation and finally, section V 
discusses the conclusion drawn from the implentation. 


II. CRYOGENIC ENGINE 


The cryogenic rocket engine described here uses cryogenic 
liquid hydrogen (LH2) fuel and the liquid oxygen (LOX) 
oxidizer [3]. The pressure regulation of LOX and LH2 is 
mission critical. The structure of cryogenic engine is shown in 
Fig 1. 
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Fig 1: Structure of cryogenic engine. 


A. Why Engine Control Unit? 


As the launch vehicle enters into different layers of the 
atmosphere, the atmospheric pressure/temperature causes the 
pressure inside the tanks to vary drastically and pressure inside 
the tanks may fall below safe limits. Hence constant 
monitoring of pressure and maintaining of pressure within the 
permissible limit should be done. So the requirement of the 
system is to ensure a minimum pressure above the vapour 
pressure at the inlet to the pumping system. The venting of 
tanks ensures proper pressure maintenance of the system. This 
operation is carried out by venting algorithms. 

The fuel to tanks is supplied from large reservoirs known as 
gas bottles. The gas bottles need to hold large amount of gas at 
high pressure. If the volume of the gas bottle is large the 


pressure it can deliver is less. To compensate this the gas 
bottles have two chambers, command gas bottle (CGB) and 
pressurization gas bottle (PGB) respectively. CGB and PGB 
are connected through a pyro valve. Normally the pyro valve 
is open to provide large volume. CGB is for keeping the 
electro pneumatic valve (EPV) intact and the PGB for 
pressurisation of the tank. The CGB pressure should always be 
greater than a specific value. When the pressure falls below 
this specific value then the valves are closed to provide 
isolation. Hence the isolation algorithm provides the isolation 
between CGB and PGB. 
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Fig 2: Environment for ECU. 

The fig 2 shows the structure along with the control for the 
implementation of both venting and isolation algorithms [4]. 
The pressure of the tank is obtained from the pressure sensors 
and accordingly the electro pneumatic valve iscontrolled to let 
the excess pressure out of the tank. The command gas bottle 
and pressurization gas bottle are connected by a pyro valve as 
shown in figure. 


B. Related works: 


Engine control was earlier a part of the main computer of 
the launch vehicle. It implements both the venting and 
isolation algorithm on software. The sensors sense the 
pressure in the tanks and send this data to the processor upon 
its request. The dedicated processor implements both the 
algorithms and sends back the output command to the valve 
for controlling the tanks. The communication is established 
through MIL STD 1553 protocol. The processor acquires the 
inputs from the sensors through request command and sends 
back the output to valves through response command. The 
processor does the entire cryogenic operations. This is an 
additional overhead on the processor and makes the MIL STD 
1553 protocol communication complicated. 


lil. DESIGN AND IMPLEMENTATION 


The advantage of decentralized FPGA implementation of 
the algorithm is that the processor overhead can be reduced 
and processor could do other time critical tasks. The proposed 
method reduces the usage of 1553 protocol also [6][7]. The 
method of hardware implementation use the protocol just for 
the communication of the sequence commands to the ECU and 


carry the status back. The hardware implementation reduces 
the data transfer requirement. 


A. Hardware: 


The ECU system includes pressure sensors, FPGA, 1553 
bus and processor. Fig 3 shows the hardware of the ECU 
system. 
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Fig 3: Hardware of ECU system. 

The Acquisition unit acquires pressure from the sensors in 
the walls of the tanks. The proposed system is an engine 
pressure control unit. It is an FPGA implementation of 
acquisition unit and processing unit. The controlling parameter 
is the pressure of the tanks and the gas bottles. Sensors acquire 
pressure from tanks and give it to the FPGA and the control 
output from FPGA is directly issued to the engine to control 
the pressure. 


B. Block Diagram: 


The block diagram of the engine control unit consists of 
acquisition module, timing module, synchronization module, 
encoder-decoder module, algorithm module and error handling 
module. The Fig 4 shows the block diagram of the ECU. 
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Fig 4: Block diagram of ECU. 
This unit vents out the excess pressure from the LOX and 
LH2 tanks by opening the electro pneumatic valve (EPV) thus 


keeping the pressure within the normal permissible limit. This 
is achieved through the venting algorithm. The same helps in 
closing the valve when the pressure falls below the normal 
level. The unit 1s also responsible for pressurizing the tanks in 
the initial stage. The pressurisation from the gas bottle is also 
controlled by this unit. The pyro valve is closed and isolation 
is provided when pressure inthe gas bottle falls below the limit 
All the modules are designed using state machine modelling 
in VHDL. Functional descriptions of each module are as 
follows: 
1) Timing module: This module takes the input clock and 
generates the required encoder clock, minor clock and major 
clock which is used by other sub modules. 
2) Synchronization module: This module provides the timing 
synchronization with the processor. 
3) Acquisition module: This module acquires pressure input 
from the sensors mounted on the walls of the tanks. The 
obtained pressure is processed with help of special hardware 
and stored in a register. The acquisition module consists of 
LOX Tank pressure acquisition system, LH2 Tank pressure 
acquisition system and Gas Bottle pressure acquisition system. 
The state machine is used for the acquisition of data and 
generation of required control signals (ADC and mux 
selection signals). The module uses a mux and ADC to acquire 
pressure data from the tanks. The averages of 8 samples are 
taken for assuring the integrity of the acquired data. The data 
is then stored so that it can be used by the algorithm module 
for pressure data processing. Fig 5 shows the state machine for 
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Fig 5: State machine for acquisition module. 
4) Algorithm module: This module computes the venting and 
isolation algorithm. The venting and isolation is done as per 
the pressure limit requirements of the system. The engine 
control unit executes the algorithms which command the 
electro pneumatic valves/ the pyro valve. The excess pressure 
is expelled out through the venting action.The Gas bottle 1s at 
a pressure of 22x10° Pa which controls the pressurization of 
both LOX and LH2 tanks. The tank LH2 is operated in the 
regulated mode. The primary function of PGB is to provide 
pressure to both tanks. The CGB keeps the valve intact which 
needs a minimum of 5x10°Pa. So the isolation threshold of 
8x10° Pa is kept. The entire life span of the single operation of 


o/7 


the algorithm falls within the major cycle duration. The major 
cycle has a period of 500 ms which is divided into 25 minor 
cycles. The venting and isolation is done if the pressure 
condition satisfies for the first 3 consecutive minor cycles of 
each major cycle. The pressure data shall be used in the 
algorithm only in the first three minor cycles of each major 
cycle. Fig 6 shows the clock cycle for ECU. 
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Fig 6 Clock cycle for ECU. 
The Algorithms are as follows: 
a) Venting algorithms: 
Algorithm A: 
Venting action of LOX tank is achieved through Algorithm A. 
Algorithm A operates in only one mode. Whenever Algorithm 
Amode off command is issued, the algorithm should stop its 
execution after closing EPV 186. Close command is also 
issued when the valve remains open for control period 
duration. 
Algorithm C: 

In case of LH2 tank, due to the property of self evaporation 
the pressure in the tank varies drastically. To compensate this 
variation in pressure, algorithm C operates in two modes. The 
modes differ only in the value of pressure limits. Whenever 
mode command is issued by processor then the algorithm C 
goes to corresponding mode ofoperation. In both the modes, 
when the pressure exceeds upper limit, the excess pressure is 
vented out by opening the EPV. When the pressure falls below 
lower limit, then pressure in the LH2 tank is to be maintained 
by closing EPV. 

During the execution in any of the modes, if the Algorithm 
C mode off command (mode() is received, then the algorithm 
should terminate its execution after closing the EPVin that 
minor cycle itself. Close command is also issued when the 
valve remains open for control period duration.If mode change 
command is received within the first three minor cycles of a 
major cycle, then it is recognized and EPV is closed 
immediately, in that minor cycle itself. Otherwise, EPV will 
be closed in the next major cycle. 

Venting algorithm is executed as two parallel processes, pre- 
processing and processing. 


e Pre-processing (Selection): 


The median of the three pressure data obtained from the 
acquisition module is computed using median logic (see fig 7). 
The bound check for the computed median value is then done. 
The bound check flag indicating the success of the bound 
check is used for selecting the pressure value for algorithm 
processing. The pre-processing starts as soon as the flight reset 
is received. 
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Fig 7: State machine for venting algorithm selection. 
Processing : 
The algorithm is invoked when the sequence command 1s 
received. The selected pressure data is checked with the tank 
upper and lower bound and decision for opening and closing 
of valve is taken accordingly. 


algselect 


Fig 8: State machine for Algorithm A processing 

Bound check failure is indicated through bound error 
counter. The open command is issued based on the pressure 
values from the sensors. The failure in the sensors result in the 
incorrect data being delivered to the algorithm. This results in 
the opening of the valve for an indeterminate period of time. 
This may lead to the lowering of pressure in the tank below 
the specified limit. Thus the integrity of the data from sensors 
is an important factor which is ensured through the control 
period (T). This is acheived by closing the valve forcibly after 
the control time (T). This avoids the chance of venting out the 
pressure for indeterminate period of time. Fig 8 shows the 
state machine for algorithm A processing and Fig 9 for 
algorithm C processing. 
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Fig 9: State machine for Algorithm C processing. 

b) Isolation Algorithm: 
Algorithm K 

Algorithm K isolates the pressurization gas bottle (PGB) 
and command gas bottle (CGB) when the gas pressure falls 
below 8x10° Pa. Pyro valve is a normally open valve, when 
fired it closes isolating the CGB and PGB.Algorithm K is to 
isolate the CGB and PGB when the combined pressure level 
falls below the specified value or when sequencing command 
is issued at the default time, whichever is earlier (see fig 10). 
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Fig 10: state machine for Algorithm K. 
Algorithm K is executed as two parallel processes: 
Pre-processing (selection) : The TMR logic of the three 
pressure indicators obtained from acquisition module is 
computed. 
Processing : The pressure indicator is checked for its 
status. If status is open for the first three consecutive minor 
cycles then command is issued to fire the pyro valve to close 
it. 
5) Error handling module : Error handling is initiated when 
the bound check fail continues for ‘28’ consecutive cycles. 
The error is reported back to the processor through the error 
counters. Upon the error detection corresponding algorithm is 
deselected. Before deselecting the corresponding valves are 
closed and algorithm enters disabled state. 
6) Encoder decoder module The 
Manchester encoder and decoder logic. 
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C. Implementation: 


1) Hardware Requirements: 

Xilinx Virtex 5 FPGA, SAR AD7876 and HI 506 single 16 
channel multiplexer. 

2) Other Requirements: 

Check-out system : RT-Linux based check-out system for 
simulating control command. 

Hardware in-loop configuration : Processor based avionics 
configuration based on 1553. 


IV. RESULTS 


The designed Engine Control Unit has been simulated using 
ModelSim. The simulation result is shown in fig 11. The 
proposed system has successfully met all the specified 
requirements. The proposed method reduces the overhead in 
the processor by freeing it to do other tasks. The offloading of 
processor by 2 ms per 20 ms (minor clock) was achieved. The 
improvement of 200 us in communication bandwidth of 1553 
protocol was also acheived. Then the design is synthesized 
using Xilinx ISE. The target system selected was Virtex 5 
FPGA. Finally the design was downloaded onto the FPGA and 
the expected results were obtained. The device utilization 
summary for ECU is shown in fig 12. Fig 13 shows the 
experimental set up for Engine Control Unit showing the 
results of venting and isolation actions. 
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Fig 12: Device utilization summary for ECU. 
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Fig 13: Experimental set up for ECU 


V. CONCLUSION 


The area of Cryogenic Rocket Engines is a vast one and new 
developments are being made in the field of Rocket 
Engineering. Due to the high specific impulse obtained during 
the ignition of fuels cryogenic engines are of much demand in 
the field of space exploration. The FPGA implementation of 
Cryo Pneumatic Engine Control offloads the processor. Thus 
the implementation reduces the complexity of the main 
processor and congestion in the communication channel 
thereby freeing the bandwidth of the channel. The system 
improves the computational margin. Using a_ specific 
algorithm makes the system more comprehensible for research 
works. 
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